Attacking practical quantum key distribution system with wavelength dependent 

beam splitter and multi-wavelength sources 
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It is well known that unconditional security of quantum key distribution(QKD) can be guaranteed 
by quantum mechanics. However, the practical QKD systems have some imperfections, which can be 
controlled by the eavesdropper to attack the secret key. With the current experimental technology, 
the realistic beam splitter, made by the fused biconical technology, has wavelength dependent prop- 
erty. Based on this fatal security loophole, we propose wavelength-dependent attacking protocol, 
which can be applied to all practical QKD systems with the passive state modulation. Moreover, 
we experimentally attack practical polarization encoding QKD system to get all the secret key 
information at the cost of only increasing quantum bit error rate from 1.3% to 1.4%. 



Quantum key distribution is the art of sharing secret 
keys between two distant parties AUce and Bob. Since 
the BB84 protocol has been proposed by Bennet and 
Brassard J| , the unconditional security of QKD protocol 
has attracted much attentions. Lo and Chau 2] proved 
unconditional security of BB84 protocol with quantum 
computer. Shor and Preskill Q proved unconditional se- 
curity of BB84 protocol by applying the entanglement 
distillation and purification (EDP) technology. More re- 
cently, Renner [4| proved unconditional security of BB84 
protocol by applying the quantum information theory 
method. 

Whereas, security analysis model based on the perfect 
QKD protocol can not be directly applied to the practi- 
cal QKD systems [5-7], Gottesman, Lo, Lukenhaus and 
Preskill 8] analyzed security of the practical QKD sys- 
tem and gave the famous secret key rate formula GLLP. 
Combining their security analysis result with decoy state 
method 9-11], practical QKD system can be realized 
with weak coherent source. But their security analysis 
can not be applied to the pra ctical QKD system with ar- 
bitrary imperfections 12|, |l3| , which may introduce side 



channel attacks. Imperfect phase modulator introducing 
phase-remapping attack has been experimentally demon- 
strated [ij]. Imperfect single photon detector (SPD) 



introducing detector blinding attack has also been pro- 
posed in Ref. [l^], they demonstrated that imperfect 
SPD can be fully remote-controlled by utilizing specially 
tailored bright illumination. More recently, dead time 
attack with imperfect SPD has been proposed in Ref. 
[l^ , in which the eavesdropper can exploit the dead time 
effect of the imperfect SPD to gain almost full secret 



information without being discovered. Jain et al. [17 1 
have proved that inappropriately implemented calibra- 
tion routine will introduce a fatal security loophole. All 
these results demonstrate that practical QKD device im- 
perfections can lead to various types of attacks 18l-23|. 
In current experimental realizations, beam splitter has 
the wavelength dependent property. Based on this im- 



perfection, we propose a new type of attacking protocol. 
Our experimental demonstration shows that this strat- 
egy can effectively attack practical passive modulated 
polarization based QKD system without being discov- 
ered, where passive(active) modulation implies that Bob 
passively(actively) select measurement bases. It should 
be noted that the attacking model can also be easily gen- 
eralized to other passive modulated QKD systems. 

Practical QKD systems can be divided into phase en- 
coded and polarization encoded respectively. In the po- 
larization based QKD systems [2J, |25[ , Bob passively se- 
lects the measurement basis by the BS for convenient and 
high speed modulation. More precisely, the 1x2 BS has 
one input port and two output ports (port 1 and port 
2), Bob can choose to measure the photon state either 
in rectilinear basis if it pass through output port 1, or 
in diagonal basis if it pass through output port 2. In 
the perfect case, the single photon state will randomly 
select to pass through one output port of the BS. But, 
the realistic BS is commonly made by the fused biconical 
taper (FBT) technology [20], the coupling ratio of the 
FBT BS is generally wavelength-dependent. We made 
a BS with FBT technology in our experimental realiza- 
tion, and found that the coupling ratio is 0.5 in the 1550 
nm wavelength, while the 1470 nm and 1290 nm source 
have the coupling ratio 0.986 and 0.003 respectively. In- 
terestingly, we can apply the 1470 nm (1290 nm) source 
to control the selection of the rectilinear basis (diago- 
nal basis) in Bob's side. Using this loophole, we present 
that Eve can control Bob's measurement basis choice re- 
motely at the cost of only increasing quantum bit error 
rate(QBER) from 1.3% to 1.4%. 

The FBT BS is made by closing two or more bare 
optical fibers, fusing them in a high temperature envi- 
ronment and drawing their two ends at the same time, 
then a specific biconic tapered waveguide structure can 
be formed in the heating area. The FBT BS can be 
used as the splitter or the coupler, it has the feature 
of low insertion loss, good directivity and low cost, so 
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many of the commercial BS products are made by this 
technology. However, coupling ratio of the FBT BS is 
wavelength-dependent, and most types of the FBT BS 
work only in a limited range of wavelength (limited band- 
width), where the coupling ratio of the BS is defined as 
{Iport2) is output light intensity 



portl 



from BS's output port 1 (output port 2). Typical cou- 
pling ratio at the center wavelength provides optimal per- 
formance, but the coupling ratio varies periodically with 
wavelength changes. We made a BS with FBT technol- 
ogy in our experimental realization, and found that it 
has distinguishing wavelength-dependent characteristic, 
detailed expression of this property can be given in Fig. 
1. 
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FIG. 1: The relationship between wavelength of the source 
and the coupling ratio, here the red dot is the practical exper- 
imental result, the red line is the theoretical analysis result. 
The right side is the single wave length fiber coupler made by 
the Newport Corporation [27| . the coupling ratio of which are 
also wavelength-dependent. 

We analyze the relationship between wavelength A and 
cou plin g ratio r by using the coupling model given in Ref. 
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where F"^ is the maximal power that is coupled, C oc A^'^ 
is the coupling coefficient, w is the heat source width. 
From Fig. 1, we can find that the realistic BS has the 
perfect coupling ratio 0.5 with 1550 nm laser diode (LD), 
in which case the BS can be regarded as perfect QKD de- 
vice. When we test it with 1290nm LD and 1470nm LD, 
the coupling ratio changed to be 0.003 and 0.986, which 
means that the 1290 nm and 1470 nm LD will mainly pass 
through BS's port 2 and prot 1 respectively. Thus the 
realistic BS can not be regarded as perfect QKD device 
in case of wavelength of the LD is not 1550 nm. Com- 
bining this imperfection with multi wavelength sources. 



we show that Eve can acquire all secret key information 
in Bob's side with very low cost [30| . 

The polarization based QKD system with passive state 
modulation can be depicted precisely in Fig. 2. After 
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FIG. 2: Schematic diagram of the polarization based QKD 
system, where 1550 LD means Alice send the quantum state 
with the 1550 nm source, BS is the beam splitter, PBS is the 
polarization beam splitter, IM is the intensity modulator, PC 
is the polarization controller, ATT is the attenuator, SPD is 
the single photon detector. 

two cascaded BS with an additional intensity modula- 
tion, four polarization states can be generated by 1550 
nm LD. More precisely, when Alice want to transmit 
the prepared quantum state, the positive voltage will be 
added on the matched IM, and the negative voltage will 
be added on the other IM respectively. Thus only the sin- 
gle photon state modulated by the positive voltage can 
be transmitted into the quantum channel. In the ideal 
polarization based QKD experimental realization, one of 
the basic assumption is that the photon state will pass 
through each output side with 50% probability. Actu- 
ally, this perfect BS in Bob's side can be regarded as 
the random bases selector. Unfortunately, the coupling 
ratio of the realistic FBT BS is wavelength-dependent 
as illustrated in the previous section. Eve can adopt 
intercept-and-resend strategy to attack practical polar- 
ization based QKD systems, where Eve's detection setup 
in the quantum channel is the same as Bob's side. Ap- 
plying her state measurement result. Eve will send the 
remodulated photon state to Bob. In this attacking pro- 
tocol, the main difficult for Eve is to find the appropriate 
LD with wavelengths Ai and A2, where Ai LD has the 
coupling ratio ri > 0.5, A2 LD has the coupling ratio 
r2 < 0.5. To attack the practical QKD system. Eve will 
send the re- modulated quantum state with Ai (A2) LD 
to Bob, if she can get the detection result with the recti- 
linear basis {0°,90°} (diagonal basis {45°, 135°}). 

We initially give the security analysis in the theoretical 
aspect under the assumption that only the BS in QKD 
system is imperfect. By considering intercept-and-resend 
strategy has been applied by Eve in the quantum channel, 
the final QBER between Alice and Bob can be given by 



l-ri 



4V2-(ri+r2) ri+r2 



(2) 



this equation can be simply calculated with the proba- 
bility tree of the state transformation as illustrated in 
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FIG. 3: Probability tree of the state transformation. Alice 
sends the modulated quantum sate to the quantum chan- 
nel, Eve gets the state detection result with probability 
Pi £ {0.25, 0.25, 0.5} in the middle stage. Bob saves his sate 
detection result after the sifting protocol with probability 
P2 € {in + ira, Irz} or {i(l - ra) + i(l - n), 1(1 - n)} 
with different measurement bases. 

Fig. 3. Utilizing Shor and Preskill's security analysis 
result with the perfect QKD 3], Alice and Bob can dis- 
till the final secret key if the QBER introduced by the 
eavesdropper is lower than 11%. In case of the cou- 
pling ration and the wavelength have a strong correla- 
tion (ri — > l,r2 — > 0), Eve can get full secret key bit 
even if the error rate is lower 'si']. We note that no se- 
cret key can be established if the error rate is lower than 
Err between two legitimate parties. More interestingly, 
even zero QBER can not generate any secret key with 
full wavelength dependent BS (ri = 1, r2 = 0). 

By using the analyzed realistic BS in the previous sec- 
tion, detailed setup of the attacking system can be illus- 
trated in Fig. 4. In this system, if Eve get the measure- 




FIG. 4: Attacking practical polarization based QKD system. 
The red area is controlled by the eavesdropper Eve, who 
will utilize the intercept-and-resend strategy by applying the 
wavelength-dependent BS and multi-wavelength sources. 

mcnt result (1) with the rectilinear basis {0°,90°}, she 
wiU prepare the quantum state |0°) (|90°)) again with the 
1470 nm LD. Conversely, if she can get the detection re- 
sult (1) with the diagonal basis {45°, 135°}, she will pre- 
pare the quantum state |45°) (|135°}) again with the 1290 
nm laser diode, where |45°) = -^(10°) + |90°)), |135°) = 

— -i=(|0°) — |90°)). We give a simple example that Alice 



sends the quantum sate |0°), and Eve gets the detection 
result [0°) in the rectilinear basis {0°,90°} with proba- 
bility 50%, then she will send the remodulated 1470 nm 
laser to the receiver Bob, since the 1470 nm laser can 
mainly pass through the port 1 of the BS in Bob's side. 
Bob can detect |0°) in the rectilinear basis with 98.6% 
success probability. If Eve get the detection result in 
the diagonal basis {45°, 135°} with the probability 50%, 
then she will send the remodulated 1290 nm laser to the 
receiver Bob, since the 1290 nm laser can mainly pass 
trough the port 2 of the BS in Bob's side. Bob can get 
the detection result in the diagonal basis with 99.7% suc- 
cess probability. Note that the detection efficiency of the 
practical SPD is also wavelength-dependent, we verified 
that the id 200 SPD [13] has detection eflticiency 12.1%, 
10.7% and 5.0% by considering wavelengths of the source 
are 1550 nm, 1470 nm and 1290 nm respectively. To solve 
this problem, we will add different attenuations after the 
1470 nm LD and 1290 nm LD, thus Bob can get the 
similar detection result in case of with and without the 
eavesdropper. 

Following the attacking model given in the previ- 
ous section, we give the photon count result in Bob's 
side by considering two cases: without the eavesdrop- 
per and with the eavesdropper respectively. In the 
first case, Alice randomly send the polarization state 
{|0°), |90°), |45°), |135°)} to the quantum channel. Con- 
sidering the practical single photon detection efficiency 
is 12.1% in 1550 nm case, we can get about 1% effective 
detection result in case of the quantum channel has 10.79 
dB attenuation. In our practical experimental realization 
without the eavesdropper, Alice send 10^ prepared quan- 
tum states, then Bob get about lO'' detection results, 
which can be illustrated precisely in Fig. 5. 

In case of with the eavesdropper, Eve will apply the 
similar detection setup, but the channel attenuation be- 
tween Alice and Eve is dB, the reason for which is that 
Eve can utilize the lossless channel instead of the stan- 
dard optical fiber. We give the detection result in Bob's 
side by considering Eve send 5 x lO'^ modulated quan- 
tum states (each pulse has two photons on average) to 
the quantum channel, the channel loss between Eve and 
Bob is 3.3 dB and dB in 1470 nm and 1290 nm cases 
respectively, then Bob can get about 5 x 10'^ effective 
detection results, detailed detection results can be illus- 
trated in Fig. 6. Comparing different types of detection 
results, we find that Eve can remotely control Bob's basis 
selection only by changing LD's wavelengths. 

Based on this strategy, polarization based QKD system 
has been attacked in our practical experimental realiza- 
tion. Bob gets the similar detection result in case of with 
and without the eavesdropper. Similarly, the QBER be- 
tween Alice and Bob only increases from 1.3% to 1.4%, 
thus Eve can get almost all of the secret key information 
without being discovered. 

In conclusion, we propose a new type of strategy to at- 
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FIG. 5: The detection result in Bob's side without 
the eavesdropper Eve. Alice sends four quantum states 
{|0°>, |90°>, |45°), |135°>} to the quantum channel with 1550 
nm LD, In Bob's side, he can get the correct detection result if 
the matched basis has been chosen. He will get the detection 
result with 50% error rate if the unmatched basis has been 
chosen correspondingly. 
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FIG. 6: The detection result in Bob's side with the eaves- 
dropper. Eve sends quantum states {|0°), |90°)} with 1470 
nm LD, sends quantum states {|45°), [135°)} with 1290 nm 
LD to the quantum channel. In Bob's side, he can only get 
the detection result in the rectilinear basis when the 1470 nm 
laser has been detected. Similarly, he can only get the detec- 
tion result in the diagonal basis when the 1290 nm laser has 
been detected. 



tack the practical polarization based QKD system by us- 
ing the wavelength-dependent BS and multi-wavelength 



sources. The eavesdropper Eve can control Bob's mea- 
surement basis with 100% success probability without 
reducing the receiver's expected detection rate or signif- 
icantly increasing the bit error rate. Our result demon- 
strate that all practical devices require security inspec- 
tion for avoiding side channel attacks in practical QKD 
experimental realizations. We note that this attacking 
protocol can not be avoided even if the wavelength filter 
was applied in Bob's side, since Eve only need increase 
the intensity of the light to attack Bob's detection setup. 
Meanwhile, we should also note that this attacking pro- 
tocol can be avoided effectively by applying the actively 
modulated phase encoding QKD systems 33l-35l|. 
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